CVE-2026-20182: Cisco Catalyst SD-WAN Auth Bypass & HUSTOJ RCE Detection Guide

---
title: Potential Cisco SD-WAN Auth Bypass Exploitation
id: 89b3c1e2-f4d6-4a8e-9b1a-2c3d4e5f6a7b
status: experimental
description: Detects potential exploitation of CVE-2026-20182 targeting Cisco Catalyst SD-WAN Controller administrative interfaces without prior authentication events.
references:
 - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-05-22-2026
author: Security Arsenal
date: 2026/05/22
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 category: proxy
 product: null
detection:
 selection:
 c_ip|startswith:
   - '10.'
   - '192.168.'
 destination_port: 443
 http_method: POST
 uri|contains:
   - '/admin'
   - '/dataservice'
   - '/sdwan'
 filter:
 sc_status: 200
 condition: selection and filter
falsepositives:
 - Legitimate administrative API calls from known management stations
level: high
---
title: HUSTOJ Zip-Slip RCE Web Shell Spawn
id: 1a2b3c4d-5e6f-7890-1234-567890abcdef
status: experimental
description: Detects potential web shell activity or code execution resulting from CVE-2026-24479 (Zip-Slip) on HUSTOJ platforms.
references:
 - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-05-22-2026
author: Security Arsenal
date: 2026/05/22
tags:
 - attack.execution
 - attack.t1505.003
logsource:
 category: process_creation
 product: linux
detection:
 selection:
 ParentImage|endswith:
   - '/apache2'
   - '/httpd'
   - '/nginx'
   - '/php-fpm'
 Image|endswith:
   - '/sh'
   - '/bash'
   - '/python'
   - '/perl'
 condition: selection
falsepositives:
 - Legitimate administrative script execution by developers
level: critical

// Hunt for Cisco SD-WAN Suspicious Administrative Access
Syslog
| where Facility in ("nginx", "apache", "syslog")
| where ProcessName contains "vmanage" or SyslogMessage contains "POST"
| parse SyslogMessage with * "POST " Path " HTTP" *
| where Path has_any ("/admin", "/dataservice/device", "/sdwan")
| project TimeGenerated, Computer, SourceIP, Path, ProcessName
| summarize count() by SourceIP, Path, bin(TimeGenerated, 5m)
| where count_ > 10 // Threshold for bulk scanning

// Hunt for HUSTOJ Web Shell Creation via Zip-Slip
DeviceProcessEvents 
| where InitiatingProcessFileName in~ ("apache2", "httpd", "nginx", "php-fpm")
| where FileName in~ ("sh", "bash", "python3", "perl", "php")
| extend ParentProc = InitiatingProcessFileName, ChildProc = FileName
| project Timestamp, DeviceName, ParentProc, ChildProc, CommandLine, AccountName
| where isnotempty(CommandLine)

-- Hunt for suspicious web server processes potentially indicating HUSTOJ RCE
SELECT Pid, Name, Exe, CommandLine, Username, StartTime
FROM pslist()
WHERE Exe =~ 'apache2' OR Exe =~ 'nginx' OR Exe =~ 'httpd'

-- Hunt for recently created files in webroot (Potential Zip-Slip artifacts)
SELECT FullPath, Size, Mode.Bits, Mtime, Atime
FROM glob(globs="/*/*/*")
WHERE Mode =~ '^d' AND Name =~ 'www' OR Name =~ 'html' OR Name =~ 'hustoj'

-- Check for shell processes spawned by web users
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Username =~ 'www-data' AND Name IN ('sh', 'bash', 'python', 'nc', 'perl')

#!/bin/bash
# Remediation and Detection Script for CVE-2026-24479 (HUSTOJ)
# Checks for common HUSTOJ installation paths and suspicious recent files

echo "[*] Checking for HUSTOJ installations..."
WEB_ROOTS=("/var/www/html" "/usr/local/apache2/htdocs" "/home/judge/src/web")

for root in "${WEB_ROOTS[@]}"; do
    if [ -d "$root" ]; then
        echo "[+] Found web root: $root"
        # Check for presence of HUSTOJ specific files (e.g., include/db_info.inc.php)
        if [ -f "$root/include/db_info.inc.php" ]; then
            echo "[!] HUSTOJ detected at $root"
            echo "[*] Searching for recently modified files (last 24 hours) which may indicate Zip-Slip exploitation:"
            find "$root" -type f -mtime -1 -ls
        fi
    fi
done

echo "[*] Checking for running shell processes owned by www-data (potential web shell):"
ps aux | grep -E '^www-data.*(sh|bash|python|perl|nc)' | grep -v grep

echo "[+] Remediation: Apply vendor patches for HUSTOJ immediately. Restrict file upload permissions to the web root."